Cyber Security Analyst (SOC Level 2)

DWP Group; Lahore; On-site; PKR 1,000,000 - 1,800,000; Full time

Job summary

DWP Group is seeking a skilled SOC Analyst - Level 2 to join our Cyber Security team in Lahore. You will monitor, investigate, and respond to security incidents, with hands-on work on IBM QRadar SIEM and related tools.

The role requires 2–3 years in an SOC, strong incident response and threat analysis skills, and the ability to mentor junior analysts while coordinating with clients and vendors.

Qualifications

• Bachelor's degree in CS/IT/Cyber Security or related field.
• 2–3 years of SOC experience.
• Hands-on IBM QRadar SIEM required.
• Experience in security monitoring, incident response, and threat analysis.
• Strong log analysis, event correlation, and use-case development.
• Python or PowerShell scripting is a plus.
• Certifications: QRadar SIEM, Security+, CEH, GCIH, SC-200 are advantageous.

Responsibilities

• Monitor and respond to incidents escalated from SOC Level 1.
• Analyze security events and alerts in depth.
• Triage incidents, determine root cause, and guide containment actions.
• Develop, optimize, and maintain QRadar use cases, rules, dashboards, and searches.
• Tune detection rules to reduce false positives and improve detection.
• Coordinate with teams, customers, and vendors during investigations.
• Lead escalations and ensure timely resolution within SLAs.
• Prepare incident reports and executive summaries for management.

Skills

SIEM

SOAR

Case management

Security incident investigation

Threat analysis

Incident response

Python/PowerShell scripting

Education

Bachelor's degree in Computer Science/IT/Cyber Security

Tools

IBM QRadar SIEM

Job description

We are looking for a skilled and proactive SOC Analyst - Level 2 to join our Cyber Security team. The ideal candidate will have hands‑on experience in SIEM, SOAR, Case Mangement, security incident investigation, threat analysis, and incident response.

Key Responsibilities

• Monitor, investigate, and respond to security incidents escalated from the SOC Level 1 team.
• Perform in-depth analysis of security events and alerts.
• Conduct incident triage, root cause analysis, and recommend appropriate containment, remediation, and recovery actions.
• Develop, optimize, and maintain SIEM/EDR use cases, correlation rules, dashboards, reports, and custom searches.
• Tune SIEM detection rules to minimize false positives and improve threat detection capabilities.
• Investigate complex security incidents involving Windows, Linux, Active Directory, firewalls, VPNs, IDS/IPS, endpoint security, and network logs.
• Coordinate with internal technical teams, customers, and third-party vendors during security incident investigations.
• Lead technical escalations and ensure timely incident resolution within agreed service levels (SLAs).
• Prepare incident reports, executive summaries, and periodic security reports for management and clients.
• Participate in customer meetings to discuss incident findings, security posture, and remediation recommendations.
• Maintain proper documentation, investigation evidence, and audit records to support compliance requirements.
• Assist in developing SOC playbooks, standard operating procedures (SOPs), and incident response workflows.
• Mentor SOC Level 1 analysts by providing technical guidance and knowledge sharing.
• Stay current with emerging cyber threats, attack techniques, threat intelligence, and industry best practices.

Qualifications:

• Bachelor's degree in Computer Science, Information Technology, Cyber Security, Software Engineering, or a related discipline.
• 2-3 years of experience in a Security Operations Center (SOC) environment.
• Hands‑on experience with IBM QRadar SIEM is mandatory.
• Experience in enterprise security monitoring, incident response, and threat analysis.
• Strong expertise in IBM QRadar SIEM, log analysis, event correlation, and use case development.
• Good understanding of Windows, Linux, Active Directory, firewall, VPN, IDS/IPS, endpoint security, and network log analysis.
• Basic scripting knowledge in Python or PowerShell will be an added advantage.
• Preferred Certifications: IBM Certified Associate Administrator - QRadar SIEM, CompTIA Security+, EC-Council Certified Ethical Hacker (CEH), GIAC Certified Incident Handler (GCIH), Microsoft SC-200: Security Operations Analyst.